
Label Flipping Attack for Human Activity Recognition Systems.
We present a label flipping attack for multi-class sensor-based HAR systems. To the best of our knowledge, this is the first work on label flipping attacks for sensor-based HAR systems. We first propose an optimal but computationally intractable version of the problem. Next, to reduce the computational cost, we present a randomized approach for the attack.

Label Flipping Attack for Multi-Class Classification Task.
While most contemporary works on label flipping attacks focus on binary classification problems, we extend the existing works to design the attack for multi-class classifiers.

k-NN-based Defense Mechanism. We extend K-Nearest Neighbor (KNN)-based defense mechanism, proposed by Paudice et al.[1]}, to evaluate the proposed attack. This extended mechanism is capable of detecting the malicious training data (whose label was changed) and predicting their correct label. The mechanism is suitable for participatory-MCS, where the collected data is partially trusted.

Empirical Study of the Label Flipping Attack and Defense.
We empirically evaluate the effectiveness of the proposed attack and defense mechanisms. In the evaluation, we utilized the popular UCI HAR dataset[2]} and developed HAR models using the following algorithms: Multi-layer Perceptron, Decision Tree, Random Forest, and XGBoost in a blackbox setting.

<FIGURE><TABLE>